--- a/sat_pubsub/pgsql_storage.py	Thu May 31 00:24:20 2012 +0200
+++ b/sat_pubsub/pgsql_storage.py	Sun Jun 03 15:57:28 2012 +0200
@@ -592,32 +592,44 @@
         return deleted
 
 
-    def getItems(self, maxItems=None):
-        return self.dbpool.runInteraction(self._getItems, maxItems)
+    def getItems(self, authorized_groups, unrestricted, maxItems=None):
+        return self.dbpool.runInteraction(self._getItems, authorized_groups, unrestricted, maxItems)
 
 
-    def _getItems(self, cursor, maxItems):
+    def _getItems(self, cursor, authorized_groups, unrestricted, maxItems):
         self._checkNodeExists(cursor)
-        query = """SELECT data FROM nodes
-                   INNER  JOIN items USING (node_id)
-                   WHERE node=%s ORDER BY date DESC"""
+        if unrestricted:
+            query = ["""SELECT data FROM nodes
+                       INNER  JOIN items USING (node_id)
+                       WHERE node=%s ORDER BY date DESC"""]
+            args = [self.nodeIdentifier]
+        else:
+            query = ["""SELECT data FROM nodes
+                       INNER  JOIN items USING (node_id)
+                       LEFT JOIN item_groups_authorized USING (item_id)
+                       WHERE node=%s AND
+                       (items.access_model='open' or
+                        (items.access_model='roster' and groupname in (%s))
+                       )
+                       ORDER BY date DESC"""]
+            args = [self.nodeIdentifier, authorized_groups]
+
         if maxItems:
-            cursor.execute(query + " LIMIT %s",
-                           (self.nodeIdentifier,
-                            maxItems))
-        else:
-            cursor.execute(query, (self.nodeIdentifier,))
+            query.append("LIMIT %s")
+            args.append(maxItems)
+       
+        cursor.execute(' '.join(query), args)
 
         result = cursor.fetchall()
         items = [stripNamespace(parseXml(r[0])) for r in result]
         return items
 
 
-    def getItemsById(self, itemIdentifiers):
+    def getItemsById(self, authorized_groups, unrestricted, itemIdentifiers):
         return self.dbpool.runInteraction(self._getItemsById, itemIdentifiers)
 
 
-    def _getItemsById(self, cursor, itemIdentifiers):
+    def _getItemsById(self, cursor, authorized_groups, unrestricted, itemIdentifiers):
         self._checkNodeExists(cursor)
         items = []
         for itemIdentifier in itemIdentifiers: